Astoundify vulnerabilities

Products

• Jobify 7
• Listify 2
• Simple Registration for WooCommerce 2
• WP Modal Popup with Cookie Integration 2
• Job Colors for WP Job Manager 1
• Jobify - Job Board WordPress Theme 1
• jobify job board wordpress theme 1
• jobify-job board 1
• wp job manager 1
• WP Job Manager – Company Profiles 1

Latest Astoundify CVEs

Newest publication first

1. CVE-2026-57336 WordPress Jobify theme <= 4.3.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-06-29

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions.

2. CVE-2026-28042 WordPress Listify plugin <= 3.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-03-05

   High·CVSS 7.1 EPSS 0.21%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Listify listify allows Reflected XSS.This issue affects Listify: from n/a through <= 3.2.5.

3. CVE-2025-67916 WordPress Jobify theme <= 4.3.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-01-08

   High·CVSS 7.1 EPSS 0.22%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue affects Jobify: from n/a through <= 4.3.0.

4. CVE-2025-59009 WordPress Listify theme <= 3.2.5 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-12-16

   Medium·CVSS 4.3 EPSS 0.13%

   Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Listify listify allows Cross Site Request Forgery.This issue affects Listify: from n/a through <= 3.2.5.

5. CVE-2025-12095 Simple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval

   Published 2025-10-25

   High·CVSS 8.8 EPSS 0.20%

   The Simple Registration for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.8. This is due to missing nonce validation on the role requests admin page handler in the includes/display-role-admin.php file. This...

6. CVE-2025-54683 WordPress WP Modal Popup with Cookie Integration Plugin plugin <= 2.4 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-08-14

   Medium·CVSS 5.9 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Reflected XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a...

7. CVE-2025-31772 WordPress WP Modal Popup with Cookie Integration plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability

   Published 2025-04-01

   Medium·CVSS 5.9 EPSS 0.38%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Stored XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a thr...

8. CVE-2025-31031 WordPress Job Colors for WP Job Manager plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

   Published 2025-03-27

   Medium·CVSS 5.9 EPSS 0.22%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Job Colors for WP Job Manager wp-job-manager-colors allows Stored XSS.This issue affects Job Colors for WP Job Manager: from n/a through <= 1.0.4.

9. CVE-2024-13698 Jobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation

   Published 2025-01-24

   Medium·CVSS 6.5 EPSS 0.33%

   The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_ai' and 'generate_image_via_ai' functions in all versions up to, and including, 4.2.7. This makes it pos...

10. CVE-2024-52480 WordPress Jobify plugin < 4.3.0 - Broken Access Control vulnerability

    Published 2024-12-09

    Critical·CVSS 9.8 EPSS 0.37%

    Missing Authorization vulnerability in Astoundify Jobify jobify.This issue affects Jobify: from n/a through < 4.3.0.

11. CVE-2023-6978 WP Job Manager – Company Profiles <= 1.7 - Reflected Cross-Site Scripting

    Published 2024-12-04

    Medium·CVSS 6.1 EPSS 0.31%

    The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'company' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

12. CVE-2024-52479 WordPress Jobify plugin < 4.3.0 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2024-12-02

    High·CVSS 8.8 EPSS 0.20%

    Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Jobify jobify allows Cross Site Request Forgery.This issue affects Jobify: from n/a through < 4.3.0.

13. CVE-2024-52478 WordPress Jobify theme < 4.3.0 - Cross Site Scripting (XSS) vulnerability

    Published 2024-12-02

    Medium·CVSS 5.4 EPSS 0.29%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Stored XSS.This issue affects Jobify: from n/a through < 4.3.0.

14. CVE-2024-52481 WordPress Jobify theme < 4.3.0 - Unauthenticated Arbitrary File Read vulnerability

    Published 2024-11-28

    High·CVSS 7.5 EPSS 0.67%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Astoundify Jobify jobify allows Relative Path Traversal.This issue affects Jobify: from n/a through < 4.3.0.

15. CVE-2024-32511 WordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerability

    Published 2024-05-17

    Critical·CVSS 9.8 EPSS 0.50%

    Improper Privilege Management vulnerability in Astoundify Simple Registration for WooCommerce allows Privilege Escalation.This issue affects Simple Registration for WooCommerce: from n/a through 1.5.6.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.